CVE-2025-65995: Apache Airflow: Disclosure of secrets to UI via kwargs
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.
The issue has been fixed in Airflow 3.1.4 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.
Other sources
When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values (such as secrets), they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG.
The issue has been fixed in Airflow 3.1.5rc1 and 2.11.1, and users are strongly advised to upgrade to prevent potential disclosure of sensitive information.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65995?
CVE-2025-65995 is categorized as a medium severity vulnerability due to the potential exposure of sensitive information such as secrets.
How do I fix CVE-2025-65995?
To fix CVE-2025-65995, users should upgrade to Apache Airflow versions 2.11.1 or 3.1.5rc1 or later.
What impact does CVE-2025-65995 have on Apache Airflow?
CVE-2025-65995 can lead to the accidental disclosure of sensitive information in the UI during the error reporting process.
Which versions of Apache Airflow are affected by CVE-2025-65995?
CVE-2025-65995 affects Apache Airflow versions prior to 2.11.1 and 3.1.5rc1.
Is there a workaround for CVE-2025-65995?
There are no official workarounds for CVE-2025-65995; upgrading to a patched version is recommended to mitigate the risk.